rea-agents 2.0.0 → 2.2.0

package/dist/domain/nodeRuntimeCharacterization.js

@@ -0,0 +1,66 @@
+import { z } from "zod";
+import { controlledReplayInputSchema, controlledReplayOutputSchema, } from "./javascriptReplay.js";
+import { javascriptExportInstrumentationInputSchema, javascriptExportTransformationManifestSchema, } from "./javascriptExportInstrumentation.js";
+import { runtimeCharacterizationPlanSchema } from "./runtimeCharacterization.js";
+import { evidenceRecordSchema } from "./evidence.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+export const nodeCharacterizationPreparationInputSchema = z
+    .strictObject({
+    preparation_approved: z.literal(true),
+    selected_alias: z.string().min(1).max(200),
+    expected_effect: z.enum(["pure", "observation-only"]),
+    instrumentation: javascriptExportInstrumentationInputSchema,
+    replay: controlledReplayInputSchema,
+})
+    .superRefine((input, context) => {
+    if (input.replay.mode !== "plan")
+        context.addIssue({
+            code: "custom",
+            path: ["replay", "mode"],
+            message: "Characterization preparation requires replay plan mode",
+        });
+    const selected = input.replay.left.modules.filter(({ alias }) => alias === input.selected_alias);
+    if (selected.length !== 1 ||
+        selected[0]?.path !== input.instrumentation.artifact_path ||
+        selected[0]?.format !== "commonjs-factory")
+        context.addIssue({
+            code: "custom",
+            path: ["selected_alias"],
+            message: "Selected alias must identify exactly one commonjs-factory instrumented artifact",
+        });
+    if (input.replay.left.entry_alias !== input.selected_alias)
+        context.addIssue({
+            code: "custom",
+            path: ["replay", "left", "entry_alias"],
+            message: "Instrumented alias must be the characterization entry",
+        });
+    if (input.replay.left.entry_export !==
+        input.instrumentation.selection.export_name)
+        context.addIssue({
+            code: "custom",
+            path: ["replay", "left", "entry_export"],
+            message: "Replay entry export must match the instrumented export",
+        });
+});
+export const nodeCharacterizationExecutionInputSchema = z.strictObject({
+    execution_approved: z.literal(true),
+    approved_plan_sha256: digestSchema,
+    preparation: nodeCharacterizationPreparationInputSchema,
+});
+export const nodeCharacterizationPreparationOutputSchema = z.strictObject({
+    schema_version: z.literal(1),
+    phase: z.literal("preparation"),
+    plan: runtimeCharacterizationPlanSchema,
+    transformation: javascriptExportTransformationManifestSchema,
+    transformation_evidence: evidenceRecordSchema,
+    replay: controlledReplayOutputSchema,
+});
+export const nodeCharacterizationExecutionOutputSchema = z.strictObject({
+    schema_version: z.literal(1),
+    phase: z.literal("execution"),
+    plan: runtimeCharacterizationPlanSchema,
+    transformation: javascriptExportTransformationManifestSchema,
+    transformation_evidence: evidenceRecordSchema,
+    evidence: evidenceRecordSchema,
+    replay: controlledReplayOutputSchema,
+});

package/dist/domain/permissionPolicy.js

@@ -65,6 +65,8 @@ export const evaluatePermission = (policy, request, now = new Date()) => {
         missing: missingFromScopes(normalized, candidates),
     };
 };
+/** Test whether one exact request is wholly contained by one ceiling. */
+export const isPermissionRequestWithinCeiling = (request, ceiling) => !hasMissing(missingFromScopes(normalizeRequest(request), [ceiling]));
 /** Consume an allowed one-shot decision; longer-lived grants are unchanged. */
 export const consumePermission = (policy, decision) => decision.lifetime === "once"
     ? {

package/dist/domain/processComparison.js

@@ -94,6 +94,25 @@ const filesystemObservations = (capture) => [
         effects: capture.filesystem_effects,
     },
 ];
+/** Canonical observations for one process-comparison dimension. */
+export const processDimensionObservations = (capture, dimension) => {
+    switch (dimension) {
+        case "terminal":
+            return terminalObservations(capture);
+        case "interaction":
+            return capture.interaction_events;
+        case "exit":
+            return [{ ...capture.exit, settlement: capture.settlement }];
+        case "filesystem":
+            return filesystemObservations(capture);
+        case "protocol":
+            return capture.protocol_events;
+        case "process":
+            return capture.process_samples;
+        case "shim":
+            return capture.shim_events;
+    }
+};
 const classifyCollection = (left, right) => {
     if (JSON.stringify(left) === JSON.stringify(right))
         return "unchanged";

package/dist/domain/processPairedExperiment.js

@@ -0,0 +1,128 @@
+import { z } from "zod";
+import { PROCESS_COMPARISON_DIMENSIONS, compareProcessCaptures, processDimensionObservations, } from "./processComparison.js";
+import { digestProcessCommitment, processScenarioSchema, } from "./processScenario.js";
+const sideIdentifierSchema = z
+    .string()
+    .regex(/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u);
+const environmentNameSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/u);
+const processDimensionSchema = z.enum(PROCESS_COMPARISON_DIMENSIONS);
+const sideBindingSchema = z
+    .object({
+    id: sideIdentifierSchema,
+    executable: z.string().startsWith("/"),
+    arguments: z.array(z.string()).max(256).optional(),
+    environment: z.record(environmentNameSchema, z.string()).default({}),
+})
+    .strict();
+/** Boundary contract for one bounded authority/candidate process experiment. */
+export const processPairedExperimentSchema = z
+    .object({
+    approved: z.literal(true),
+    shared_scenario: processScenarioSchema,
+    authority: sideBindingSchema,
+    candidate: sideBindingSchema,
+    repeat_count: z.number().int().min(2).max(10).default(3),
+    freshness_policy: z
+        .object({
+        max_capture_age_ms: z.number().int().positive().max(86_400_000),
+    })
+        .strict(),
+    required_dimensions: z
+        .array(processDimensionSchema)
+        .min(1)
+        .max(PROCESS_COMPARISON_DIMENSIONS.length)
+        .default([...PROCESS_COMPARISON_DIMENSIONS]),
+})
+    .strict()
+    .superRefine((experiment, context) => {
+    if (experiment.authority.id === experiment.candidate.id)
+        context.addIssue({
+            code: "custom",
+            message: "authority and candidate identities must differ",
+            path: ["candidate", "id"],
+        });
+    if (new Set(experiment.required_dimensions).size !==
+        experiment.required_dimensions.length)
+        context.addIssue({
+            code: "custom",
+            message: "required process dimensions must be unique",
+            path: ["required_dimensions"],
+        });
+});
+/** Apply a side binding without changing the shared observation contract. */
+export const bindProcessScenario = (shared, side) => processScenarioSchema.parse({
+    ...shared,
+    executable: side.executable,
+    arguments: side.arguments ?? shared.arguments,
+    environment: { ...shared.environment, ...side.environment },
+});
+const classifyInstability = (dimensions) => {
+    if (dimensions.has("exit"))
+        return "flaky_exit";
+    if (dimensions.has("filesystem") || dimensions.has("process"))
+        return "environmental_drift";
+    return "nondeterministic_output";
+};
+const timingKeys = new Set([
+    "at_ms",
+    "scheduled_at_ms",
+    "dispatched_at_ms",
+    "elapsed_ms",
+]);
+const withoutTiming = (value) => typeof value !== "object" || value === null || Array.isArray(value)
+    ? value
+    : Object.fromEntries(Object.entries(value).filter(([key]) => !timingKeys.has(key)));
+const observationsWithoutTiming = (capture, dimension) => dimension === "exit"
+    ? [
+        {
+            ...capture.exit,
+            settlement: {
+                state: capture.settlement.state,
+                cleanup_outcome: capture.settlement.cleanup_outcome,
+            },
+        },
+    ]
+    : processDimensionObservations(capture, dimension).map(withoutTiming);
+const hasOnlyTimingVariance = (captures, dimensions) => dimensions.every((dimension) => {
+    const first = captures[0];
+    if (first === undefined)
+        return false;
+    const baseline = JSON.stringify(observationsWithoutTiming(first, dimension));
+    return captures
+        .slice(1)
+        .every((capture) => JSON.stringify(observationsWithoutTiming(capture, dimension)) ===
+        baseline);
+});
+/** Compare same-side repeats before permitting a cross-side claim. */
+export const analyzeProcessRepeatability = (captures, requiredDimensions) => {
+    if (captures.length < 2)
+        return {
+            classification: "insufficient_samples",
+            stable: false,
+            digest: digestProcessCommitment({ captures: [], requiredDimensions }),
+            comparisons: [],
+            unstable_dimensions: [],
+        };
+    const baseline = captures[0];
+    if (baseline === undefined)
+        throw new TypeError("Repeatability analysis lost its baseline capture");
+    const comparisons = captures
+        .slice(1)
+        .map((capture) => compareProcessCaptures(baseline, capture));
+    const unstable = new Set(requiredDimensions.filter((dimension) => comparisons.some((comparison) => comparison[dimension] !== "unchanged")));
+    const unstableDimensions = PROCESS_COMPARISON_DIMENSIONS.filter((dimension) => unstable.has(dimension));
+    return {
+        classification: unstable.size === 0
+            ? "stable"
+            : hasOnlyTimingVariance(captures, unstableDimensions)
+                ? "timing_variance"
+                : classifyInstability(unstable),
+        stable: unstable.size === 0,
+        digest: digestProcessCommitment({
+            requiredDimensions,
+            comparisons,
+        }),
+        comparisons,
+        unstable_dimensions: unstableDimensions,
+    };
+};

package/dist/domain/reconstructionCoverage.js

@@ -0,0 +1,387 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { evidenceBundleSchema, parseEvidenceBundle } from "./evidenceBundle.js";
+import { evaluateReconstructionClaims, evaluateReconstructionPackageProofs, evaluateReconstructionSurfaces, evaluateReconstructionWorkspaceRisks, recommendedReconstructionProbes, } from "./reconstructionCoverageEvaluation.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const stableIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._:/-]{0,199}$/u);
+const boundedTextSchema = z.string().trim().min(1).max(4_096);
+const authoritySchema = z.enum([
+    "observed",
+    "derived",
+    "inferred",
+    "historical",
+    "external",
+]);
+const artifactSchema = z.strictObject({
+    artifact_id: stableIdSchema,
+    artifact_sha256: digestSchema,
+    version: z.string().trim().min(1).max(500),
+    environment_sha256: digestSchema,
+    evidence_ids: z.array(evidenceIdSchema).min(1).max(1_000),
+});
+const surfaceSchema = z.strictObject({
+    surface_id: stableIdSchema,
+    family: z.string().trim().min(1).max(100),
+    artifact_id: stableIdSchema,
+    occurrence_id: z.string().trim().min(1).max(500).nullable(),
+    location: boundedTextSchema,
+    authority: authoritySchema,
+    dependency_surface_ids: z.array(stableIdSchema).max(1_000),
+    evidence_ids: z.array(evidenceIdSchema).min(1).max(1_000),
+});
+const implementationOwnerSchema = z.strictObject({
+    disposition: z.literal("implemented"),
+    owner_path: boundedTextSchema,
+    owner_export: z.string().trim().min(1).max(500).nullable(),
+    owner_sha256: digestSchema,
+    path_state: z.enum(["present", "missing", "unknown"]),
+    package_state: z.enum(["distributed", "missing", "unknown"]),
+    authority_route: z.enum(["none", "detected", "unknown"]),
+});
+const externalOwnerSchema = z.strictObject({
+    disposition: z.enum(["external", "non-goal"]),
+    rationale: boundedTextSchema,
+});
+const ownerSchema = z.strictObject({
+    surface_id: stableIdSchema,
+    ownership: z.discriminatedUnion("disposition", [
+        implementationOwnerSchema,
+        externalOwnerSchema,
+    ]),
+});
+const claimSchema = z.strictObject({
+    claim_id: stableIdSchema,
+    title: z.string().trim().min(1).max(500),
+    kind: z.string().trim().min(1).max(100),
+    surface_ids: z.array(stableIdSchema).min(1).max(1_000),
+    required_dimensions: z.array(stableIdSchema).min(1).max(100),
+    required_authority: z.enum([
+        "shipped-artifact",
+        "controlled-replay",
+        "live-observation",
+        "external",
+    ]),
+});
+const verifierContractBaseSchema = z.strictObject({
+    verifier_id: stableIdSchema,
+    claim_ids: z.array(stableIdSchema).min(1).max(1_000),
+    dimensions: z.array(stableIdSchema).min(1).max(100),
+    authority: z.enum([
+        "shipped-artifact",
+        "controlled-replay",
+        "live-observation",
+        "external",
+    ]),
+    max_age_ms: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+    minimum_repeats: z.number().int().min(1).max(1_000),
+    normalization_sha256: digestSchema,
+    normalization_removes_dimensions: z.literal(false),
+});
+const verifierContractSchema = verifierContractBaseSchema.extend({
+    contract_sha256: digestSchema,
+});
+const verifierResultSchema = z.strictObject({
+    verifier_id: stableIdSchema,
+    contract_sha256: digestSchema,
+    observed_at: z.string().datetime({ offset: true }),
+    status: z.enum([
+        "pass",
+        "fail",
+        "unknown",
+        "unsupported",
+        "truncated",
+        "skipped",
+    ]),
+    covered_claim_ids: z.array(stableIdSchema).min(1).max(1_000),
+    covered_dimensions: z.array(stableIdSchema).min(1).max(100),
+    artifact_sha256s: z.array(digestSchema).min(1).max(1_000),
+    owner_sha256s: z.array(digestSchema).max(1_000),
+    normalization_sha256: digestSchema,
+    repeats: z.number().int().min(1).max(1_000),
+    evidence_ids: z.array(evidenceIdSchema).min(1).max(1_000),
+});
+const contradictionSchema = z.strictObject({
+    contradiction_id: stableIdSchema,
+    status: z.enum(["active", "resolved"]),
+    surface_ids: z.array(stableIdSchema).max(1_000),
+    claim_ids: z.array(stableIdSchema).max(1_000),
+    evidence_ids: z.array(evidenceIdSchema).min(2).max(1_000),
+});
+const packageProofSchema = z.strictObject({
+    proof_id: stableIdSchema,
+    kind: z.enum([
+        "build",
+        "clean-install",
+        "package-contents",
+        "runtime-routing",
+        "authority-independence",
+    ]),
+    status: z.enum(["pass", "fail", "unknown", "unsupported", "skipped"]),
+    artifact_sha256s: z.array(digestSchema).min(1).max(1_000),
+    evidence_ids: z.array(evidenceIdSchema).min(1).max(1_000),
+});
+const boundarySchema = z.strictObject({
+    boundary_id: stableIdSchema,
+    title: z.string().trim().min(1).max(500),
+    required_surface_ids: z.array(stableIdSchema).min(1).max(10_000),
+    required_claim_ids: z.array(stableIdSchema).min(1).max(10_000),
+    required_package_proof_kinds: z
+        .array(packageProofSchema.shape.kind)
+        .min(1)
+        .max(5),
+    allowed_dispositions: z.array(z.enum(["external", "non-goal"])).max(2),
+    allowed_unknown_ids: z.array(stableIdSchema).max(1_000),
+});
+const workspaceSemanticSchema = z.strictObject({
+    schema_version: z.literal(1),
+    workspace_id: z.string().regex(/^rcw_[a-f0-9]{64}$/u),
+    name: z.string().trim().min(1).max(200),
+    revision: z.number().int().min(1),
+    previous_revision_sha256: digestSchema.nullable(),
+    evidence_bundle: evidenceBundleSchema,
+    artifacts: z.array(artifactSchema).max(1_000),
+    surfaces: z.array(surfaceSchema).max(10_000),
+    owners: z.array(ownerSchema).max(10_000),
+    claims: z.array(claimSchema).max(10_000),
+    verifier_contracts: z.array(verifierContractSchema).max(10_000),
+    verifier_results: z.array(verifierResultSchema).max(100_000),
+    residual_unknown_ids: z.array(stableIdSchema).max(10_000),
+    contradictions: z.array(contradictionSchema).max(10_000),
+    package_proofs: z.array(packageProofSchema).max(10_000),
+    boundaries: z.array(boundarySchema).max(1_000),
+});
+export const reconstructionCoverageWorkspaceSchema = workspaceSemanticSchema.extend({ revision_sha256: digestSchema });
+const closureReasonSchema = z.strictObject({
+    code: z.enum([
+        "surface-missing",
+        "owner-missing",
+        "owner-duplicate",
+        "owner-path-missing",
+        "owner-path-unknown",
+        "owner-undistributed",
+        "owner-distribution-unknown",
+        "authority-routing-detected",
+        "authority-routing-unknown",
+        "disposition-not-allowed",
+        "dependency-surface-missing",
+        "claim-missing",
+        "verifier-missing",
+        "verifier-duplicate",
+        "verifier-result-missing",
+        "verifier-result-stale",
+        "verifier-result-incompatible",
+        "verifier-failed",
+        "verifier-unknown",
+        "active-unknown",
+        "active-contradiction",
+        "package-proof-missing",
+        "package-proof-failed",
+        "package-proof-unknown",
+    ]),
+    subject_id: stableIdSchema,
+    detail: boundedTextSchema,
+});
+export const reconstructionClosureResultSchema = z.strictObject({
+    boundary_id: stableIdSchema,
+    status: z.enum(["partial", "failed", "unknown", "ready"]),
+    workspace_revision_sha256: digestSchema,
+    summary: z.strictObject({
+        required_surfaces: z.number().int().min(0),
+        required_claims: z.number().int().min(0),
+        reasons: z.number().int().min(0),
+    }),
+    reasons: z.array(closureReasonSchema).max(100_000),
+    recommended_probes: z
+        .array(z.strictObject({
+        operation: stableIdSchema,
+        subject_id: stableIdSchema,
+        rationale: boundedTextSchema,
+    }))
+        .max(100_000),
+    evidence_ids: z.array(evidenceIdSchema).max(100_000),
+});
+/** Build a verifier contract whose digest prevents retrospective coverage edits. */
+export const createReconstructionVerifierContract = (input) => {
+    const parsed = verifierContractBaseSchema.parse(input);
+    return verifierContractSchema.parse({
+        ...parsed,
+        contract_sha256: digest(parsed),
+    });
+};
+/** Build one canonical immutable coverage-workspace revision. */
+export const createReconstructionCoverageWorkspace = (input) => {
+    const semanticInput = {
+        schema_version: 1,
+        workspace_id: `rcw_${digest({ schema: "rea.reconstruction-coverage-workspace/v1", name: input.name })}`,
+        ...input,
+    };
+    const semantic = canonicalWorkspace(workspaceSemanticSchema.parse(semanticInput));
+    validateWorkspaceReferences(semantic);
+    return reconstructionCoverageWorkspaceSchema.parse({
+        ...semantic,
+        revision_sha256: digest(semantic),
+    });
+};
+/** Parse persisted coverage state and verify canonical order, references, and digests. */
+export const parseReconstructionCoverageWorkspace = (input) => {
+    const parsed = reconstructionCoverageWorkspaceSchema.parse(input);
+    const rebuilt = createReconstructionCoverageWorkspace({
+        name: parsed.name,
+        revision: parsed.revision,
+        previous_revision_sha256: parsed.previous_revision_sha256,
+        evidence_bundle: parsed.evidence_bundle,
+        artifacts: parsed.artifacts,
+        surfaces: parsed.surfaces,
+        owners: parsed.owners,
+        claims: parsed.claims,
+        verifier_contracts: parsed.verifier_contracts,
+        verifier_results: parsed.verifier_results,
+        residual_unknown_ids: parsed.residual_unknown_ids,
+        contradictions: parsed.contradictions,
+        package_proofs: parsed.package_proofs,
+        boundaries: parsed.boundaries,
+    });
+    if (parsed.workspace_id !== rebuilt.workspace_id ||
+        parsed.revision_sha256 !== rebuilt.revision_sha256 ||
+        JSON.stringify(parsed) !== JSON.stringify(rebuilt))
+        throw new TypeError("Reconstruction coverage workspace is not canonical");
+    return rebuilt;
+};
+/** Serialize one validated coverage revision as byte-stable canonical JSON. */
+export const serializeReconstructionCoverageWorkspace = (workspace) => {
+    const encoded = canonicalize(parseReconstructionCoverageWorkspace(workspace));
+    if (encoded === undefined)
+        throw new TypeError("Reconstruction coverage workspace is not canonical JSON");
+    return encoded;
+};
+/** Evaluate one named completion boundary without inferring undiscovered coverage. */
+export const evaluateReconstructionClosure = (workspaceInput, boundaryId, nowEpochMs) => {
+    const workspace = parseReconstructionCoverageWorkspace(workspaceInput);
+    const boundary = workspace.boundaries.find(({ boundary_id: id }) => id === boundaryId);
+    if (boundary === undefined)
+        throw new TypeError(`Unknown reconstruction boundary: ${boundaryId}`);
+    const context = {
+        workspace,
+        boundary,
+        nowEpochMs,
+        reasons: [],
+        evidenceIds: new Set(),
+    };
+    evaluateReconstructionSurfaces(context);
+    evaluateReconstructionClaims(context);
+    evaluateReconstructionWorkspaceRisks(context);
+    evaluateReconstructionPackageProofs(context);
+    const reasons = [...context.reasons].sort(reasonOrder);
+    return reconstructionClosureResultSchema.parse({
+        boundary_id: boundary.boundary_id,
+        status: closureStatus(reasons),
+        workspace_revision_sha256: workspace.revision_sha256,
+        summary: {
+            required_surfaces: boundary.required_surface_ids.length,
+            required_claims: boundary.required_claim_ids.length,
+            reasons: reasons.length,
+        },
+        reasons,
+        recommended_probes: recommendedReconstructionProbes(reasons),
+        evidence_ids: [...context.evidenceIds].sort(),
+    });
+};
+const validateWorkspaceReferences = (workspace) => {
+    const evidenceBundle = parseEvidenceBundle(workspace.evidence_bundle);
+    const evidenceIds = new Set(evidenceBundle.records.map(({ evidence_id: id }) => id));
+    const unknownIds = new Set(evidenceBundle.unknowns.map(({ unknown_id: id }) => id));
+    const artifacts = assertUnique(workspace.artifacts, "artifact_id");
+    const surfaces = assertUnique(workspace.surfaces, "surface_id");
+    const claims = assertUnique(workspace.claims, "claim_id");
+    const contracts = assertUnique(workspace.verifier_contracts, "verifier_id");
+    assertUnique(workspace.contradictions, "contradiction_id");
+    assertUnique(workspace.package_proofs, "proof_id");
+    assertUnique(workspace.boundaries, "boundary_id");
+    for (const contract of workspace.verifier_contracts) {
+        const { contract_sha256: contractSha256, ...base } = contract;
+        if (contractSha256 !== digest(verifierContractBaseSchema.parse(base)))
+            throw new TypeError(`Verifier contract digest is invalid: ${contract.verifier_id}`);
+    }
+    for (const surface of workspace.surfaces)
+        if (!artifacts.has(surface.artifact_id))
+            throw new TypeError(`Surface artifact is missing: ${surface.surface_id}`);
+    for (const owner of workspace.owners)
+        if (!surfaces.has(owner.surface_id))
+            throw new TypeError(`Owner surface is missing: ${owner.surface_id}`);
+    for (const claim of workspace.claims)
+        if (claim.surface_ids.some((id) => !surfaces.has(id)))
+            throw new TypeError(`Claim surface is missing: ${claim.claim_id}`);
+    for (const contract of workspace.verifier_contracts)
+        if (contract.claim_ids.some((id) => !claims.has(id)))
+            throw new TypeError(`Verifier claim is missing: ${contract.verifier_id}`);
+    for (const result of workspace.verifier_results)
+        if (!contracts.has(result.verifier_id))
+            throw new TypeError(`Verifier result contract is missing: ${result.verifier_id}`);
+    const referencedEvidenceIds = [
+        ...workspace.artifacts.flatMap(({ evidence_ids: ids }) => ids),
+        ...workspace.surfaces.flatMap(({ evidence_ids: ids }) => ids),
+        ...workspace.verifier_results.flatMap(({ evidence_ids: ids }) => ids),
+        ...workspace.contradictions.flatMap(({ evidence_ids: ids }) => ids),
+        ...workspace.package_proofs.flatMap(({ evidence_ids: ids }) => ids),
+    ];
+    const danglingEvidence = referencedEvidenceIds.find((id) => !evidenceIds.has(id));
+    if (danglingEvidence !== undefined)
+        throw new TypeError(`Coverage workspace Evidence is missing: ${danglingEvidence}`);
+    const danglingUnknown = workspace.residual_unknown_ids.find((id) => !unknownIds.has(id));
+    if (danglingUnknown !== undefined)
+        throw new TypeError(`Coverage workspace residual unknown is missing: ${danglingUnknown}`);
+};
+const canonicalWorkspace = (workspace) => ({
+    ...workspace,
+    artifacts: sorted(workspace.artifacts, "artifact_id"),
+    surfaces: sorted(workspace.surfaces, "surface_id"),
+    owners: [...workspace.owners].sort((left, right) => left.surface_id.localeCompare(right.surface_id)),
+    claims: sorted(workspace.claims, "claim_id"),
+    verifier_contracts: sorted(workspace.verifier_contracts, "verifier_id"),
+    verifier_results: [...workspace.verifier_results].sort((left, right) => `${left.verifier_id}:${left.observed_at}`.localeCompare(`${right.verifier_id}:${right.observed_at}`)),
+    residual_unknown_ids: [...new Set(workspace.residual_unknown_ids)].sort(),
+    contradictions: sorted(workspace.contradictions, "contradiction_id"),
+    package_proofs: sorted(workspace.package_proofs, "proof_id"),
+    boundaries: sorted(workspace.boundaries, "boundary_id"),
+});
+const sorted = (items, key) => [...items].sort((left, right) => left[key].localeCompare(right[key]));
+const assertUnique = (items, key) => {
+    const values = items.map((item) => item[key]);
+    if (new Set(values).size !== values.length)
+        throw new TypeError(`Duplicate reconstruction coverage ${String(key)}`);
+    return new Set(values);
+};
+const closureStatus = (reasons) => {
+    if (reasons.length === 0)
+        return "ready";
+    if (reasons.some(({ code }) => [
+        "verifier-failed",
+        "active-contradiction",
+        "authority-routing-detected",
+        "owner-path-missing",
+        "owner-undistributed",
+        "package-proof-failed",
+    ].includes(code)))
+        return "failed";
+    if (reasons.some(({ code }) => [
+        "verifier-result-stale",
+        "verifier-result-incompatible",
+        "verifier-unknown",
+        "active-unknown",
+        "owner-path-unknown",
+        "owner-distribution-unknown",
+        "authority-routing-unknown",
+        "package-proof-unknown",
+    ].includes(code)))
+        return "unknown";
+    return "partial";
+};
+const reasonOrder = (left, right) => `${left.code}:${left.subject_id}`.localeCompare(`${right.code}:${right.subject_id}`);
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Reconstruction coverage value is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};